Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to Only allow certain MAC addresses to get a IP from my DHCP server, currently I use dnsmasq and I rather not change dhcp server but I'm open to other software aswell. However, I need to be able to set static IP addresses for specific MAC addresses.

currently my dnsmasq conf file has a bunch of entries that specify static IPs for a range of MAC addresses like so:


Is there a way so that All MAC addresses that are Not specified in the above fashion doensn't get an IP?

share|improve this question
up vote 5 down vote accepted

You can do this by specifying only a static range


EDIT: Change the address range above to meet your requirements.

With no dynamic ranges specified dnsmask will only provide addresses to hosts that have a corresponding dhcp-host configuration

# Specify a subnet which can't be used for dynamic address allocation,
# is available for hosts with matching --dhcp-host lines. Note that
# dhcp-host declarations will be ignored unless there is a dhcp-range
# of some type for the subnet in question.
# In this case the netmask is implied (it comes from the network
# configuration on the machine running dnsmasq) it is possible to give
# an explicit netmask instead.
share|improve this answer
I had to set dhcp-range to ",static", then it worked like a charm! Thank you! – Joelbitar Aug 18 '11 at 20:00

Alternatively to @Chopper3 's solution, you can add iptables rules like these

# Create the DHCP_clients chain in the 'raw' table
iptables -t raw -N DHCP_clients

# Incoming DHCP, pass to chain processing DHCP
iptables -t raw -A PREROUTING -p udp --dport 67 -j DHCP_clients

# Allowed DHCP clients
iptables -t raw -A DHCP_clients -m mac --mac-source 00:11:22:33:44:55 -j ACCEPT
iptables -t raw -A DHCP_clients -m mac --mac-source 00:11:22:33:44:56 -j ACCEPT
iptables -t raw -A DHCP_clients -m mac --mac-source 00:11:22:33:44:57 -j ACCEPT

# Deny other clients not listed above
iptables -t raw -A DHCP_clients -j DROP

Edit: If you need to add additional 'known'/allowed clients, just do the following for each additional client:

# We insert a rule at the head of the chain using the '-I' command
iptables -t raw -I DHCP_clients -m mac --mac-source $CLIENT_MAC -j ACCEPT

(Note: it's using -I (insert) instead of -A (append), so the new rule will be the first rule to be checked. If we don't insert, appended rules will be overridden by the rule with -j DROP)

share|improve this answer
I prefer this way. IMO this rejects the unknown requests in more low level. Btw, i couldn't create a custom chain using your commands, it gives error. I had to use -A PREROUTING -p udp --dport 67 in every line :P – Sarim May 21 '15 at 10:19
@Sarim oh my, I forgot to add one very important line: iptables -t raw -N DHCP_clients -- this line creates the DHCP_clients chain. I'll edit. – pepoluan May 22 '15 at 7:52
# Ignore any clients which are not specified in dhcp-host lines
# or /etc/ethers. Equivalent to ISC "deny unknown-clients".
# This relies on the special "known" tag which is set when
# a host is matched.
share|improve this answer

If you only want specific MACs to get DHCP addresses just create your list of reservations as you have then set the range to cover only those IP addresses. That way it won't have any more addresses to hand out.

share|improve this answer

I have to disagree to the previous fixes. except for pepoluan's answer.

Although i don't know if pepoluan's is a true white list technique, it is close to the right answer. To block all data to the wrong mac is your goal. Just disabling dhcp to non registered mac's is not a fix, if they set manual ip's which is usually one of 3 ranges... 10.0.0.x, 192.168.1.x or 192.168.0.x doesnt answer the problem.

If you do use the other proposed answer of not handing out dhcp to unknown mac's, besure to also change your router's address to a unique unguessable option, and to change your ip range to a really strange one. e.g. 192.168.43.x with the router being or something. this would dissalow them to guess your subnet range, and have no link to the network.

It's not flawless, but it is a much better way to protect your network.

share|improve this answer
This isn't going to do any good either; you could break it in seconds. The only way to protect your network from this threat is 802.1x, assuming the goal here is to prevent unauthorized network access. – Falcon Momot Nov 27 '14 at 6:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.